Electronic commerce is rapidly becoming a ubiquitous means of conducting business. The growing popularity of the Internet and World Wide Web has opened new avenues for the conduct of business. Execution of complicated business transactions electronically present a number legal and financial problems.
Security of electronic transactions is an area of concern because messages transmitted across public networks can be intercepted. A number of encryption methods have been developed which allow a message to be read only by the designated receiver. Using so-called public key encryption, party A sending a message to party B first encrypts the message using B's public key. B's public key can be freely distributed to anyone B wishes to communicate with. Only B's private key can decrypt the message. B keeps his private key secret and uses it to decode the message. If the message is intercepted it cannot be decoded without B's private key.
The identity of a party transmitting a message executing an electronic transaction is also of concern, particularly where one of the parties is obliged to perform in the future or is subject to some future liability. In such transactions it is necessary that the parties not be able to repudiate the agreement. Also, the identity of the parties must be clearly established so that each can be assured that the other party is in fact the person it represents to be, and is able to perform. Further, the identity of the parties may need to be established with a high degree of certainty to support a legal claim, should one of the parties later attempt to avoid or repudiate the transaction.
Digital signatures have been developed to provide a means for identifying a party transmitting an electronic message. One method for creating digital signatures is to generate public and private key pairs for each of a group of parties that may wish to exchange digitally signed documents. Each of the parties stores its public decrypting keys in a registry along with identifying information, such as the key owner's name and e-mail address. The key owners each keep their private encrypting keys secret.
To create a digital signature a party encrypts a message with his private encrypting key that includes the same identifying information that is stored in the registry. The party receiving the encrypted message goes to the registry and retrieves the sending party's public decrypting key and identifying information. The receiving party decrypts the message using the decrypting key from the registry and extracts the identifying information. If the identifying information found in the message matches the information stored in the registry then the receiving party concludes that the message is genuine. Further, there is some assurance that the sending party will not deny that he sent the message since only the sending party's private encrypting key can create a message that the sending party's public decrypting key can decode. A discussion of known digital signature techniques may be found, for example, in Meyer, Carl H. and Matyas, Stephen M., Cryptography, Chapter 9, pp. 386-427, John Wiley & Sons, 1982.
Known digital signature techniques suffer from certain problems. A third party may intercept a signed message and use the signed message to spoof another party. By retransmitting the signed message, the interceptor may be able to convince a recipient that he is the true sender. This is the so-called "man-in-the-middle" attack.
In addition, known digital signatures are subject to repudiation. A party may no longer wish to be bound by a disadvantageous agreement or may be subject to criminal or civil liability if he made the agreement. That party may simply deny sending a particular message. The party may claim that he did not intend to execute a transaction with a particular party but was instead the victim of a man-in-the-middle attack.
With known digital signature techniques, the only information connecting the sender with the message is the database entry in the registry containing his public decrypting key and the identifying information. Thus, the sender may repudiate a transaction by claiming that his public decrypting key was registered without his authority.